{"id":235018,"date":"2026-06-22T09:20:00","date_gmt":"2026-06-22T13:20:00","guid":{"rendered":"https:\/\/testing.news-you-need.com\/index.php\/2026\/06\/22\/new-oxloader-loader-uses-malicious-google-ads-to-deliver-castlestealer\/"},"modified":"2026-06-22T09:50:09","modified_gmt":"2026-06-22T13:50:09","slug":"new-oxloader-loader-uses-malicious-google-ads-to-deliver-castlestealer","status":"publish","type":"post","link":"https:\/\/testing.news-you-need.com\/index.php\/2026\/06\/22\/new-oxloader-loader-uses-malicious-google-ads-to-deliver-castlestealer\/","title":{"rendered":"New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer"},"content":{"rendered":"

New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/06\/new-oxloader-loader-uses-malicious.html<\/a><\/p>\n

Publish Date: 2026-06-22 09:20:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

Author: <\/a><\/p>\n

Using an unordered list, summarize the following article with between 4 and 8 key points.
\n\ue804Ravie Lakshmanan\ue802Jun 22, 2026Malvertising \/ Endpoint Security
\nCybersecurity researchers have disclosed details of a new campaign that delivers CastleStealer by means of a previously unreported malware loader dubbed OXLOADER.<\/p>\n

According to Elastic Security Labs, the campaign leverages malicious Google Ads as a starting point to distribute the malware. Evidence indicates that the threat actor is likely Russian-speaking and financially motivated, owing to the presence of explicit exclusions to prevent infecting machines located in the Commonwealth of Independent States (CIS) region. The campaign has been codenamed REF8372.<\/p>\n

“The loader uses several obfuscation layers (control-flow flattening, opaque predicates, mixed Boolean-Arithmetic), self-modifying decryption stubs, and abuses the Windows .reloc section to stage shellcode,” researchers Daniel Stepanic and Jia Yu Chan said in a technical breakdown.<\/p>\n

The attack begins when unsuspecting users enter queries such as “lts version of node.js” on search engines like Google, redirecting them to a fake website (“node-js[.]prentiva99[.]info”) surfaced via bogus ads published under the verified name “\u0412\u041e\u041b\u041e\u0414\u0418\u041c\u0418\u0420 \u0422\u0415\u0420\u0415\u0429\u0415\u041d\u041a\u041e” that’s purportedly based in Ukraine.<\/p>\n

It’s currently unknown if the advertiser account is linked to the actual threat actor, or if it’s a front account or a purchased identity. The advertiser account, along with its ad campaigns, was removed from Google on May 14, 2026.<\/p>\n

Users who end up interacting with the site are served a batch script hosted on Storj, a decentralized, open-source cloud storage platform. The abuse of Storj once again illustrates how threat actors continue to leverage legitimate services to evade domain-based reputation filters.<\/p>\n

Running the batch script displays a bogus installation wizard user interface (UI), while stealthily downloading a next-stage payload, a Storj-hosted executable dubbed OXLOADER through a PowerShell command and executing it with -Verb RunAs to trigger a Windows User Account Control (UAC) prompt.\u00a0<\/p>\n

The attack then employs DLL side-loading to launch a rogue DLL, which then proceeds to decrypt and execute the CastleStealer payload. OXLOADER also makes use of techniques like control-flow flattening (CFF) and mixed Boolean-Arithmetic (MBA) to evade static detection, while also taking steps to ensure it’s not run on sandboxed environments.<\/p>\n

CastleStealer is a .NET information stealer that was recently distributed alongside CastleLoader through a ClickFix-style lure masquerading as a free image-editing tool as part of a campaign codenamed BackgroundFix. CastleLoader is attributed to a threat activity cluster known as GrayBravo.<\/p>\n

“OXLOADER is in an early operational phase, but the engineering behind it suggests this family is worth watching,” Elastic said. “The code obfuscation, anti-VM measures, benign-looking code used to masquerade its binaries, and unique staging techniques reflect deliberate engineering choices to evade analysis.”<\/p>\n

“That investment is paying off, resulting in low detection rates across static engines and detonation runs, giving OXLOADER a window to operate before it gets hunted down.”<\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

New OXLOADER Loader Uses Malicious Google Ads to Deliver CastleStealer https:\/\/thehackernews.com\/2026\/06\/new-oxloader-loader-uses-malicious.html Publish Date: 2026-06-22 09:20:00…<\/p>\n","protected":false},"author":1,"featured_media":235019,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi8sz7SHbQd4E8HNEKbvGGSYhPpJrUydP_gCRt_mWYYTr6QHLmChyphenhyphenca6BXhLBXA4OyKw-eS9xbqRqpKcYWFqDp4HoLBYKjVdWzhF0K1pqjX2bPtB91y1P1PZ8gh5r7Bpp-PIeUJVi_Hki91Qf6YjFAtFmf-qh7V9gNzmbEh_A2lISCvCDnNMALAuiqAlkL_\/s1600\/loader.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,32,34],"class_list":["post-235018","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-malware","tag-threat-actor"],"_links":{"self":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/235018"}],"collection":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=235018"}],"version-history":[{"count":1,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/235018\/revisions"}],"predecessor-version":[{"id":235020,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/235018\/revisions\/235020"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/235019"}],"wp:attachment":[{"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=235018"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=235018"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/testing.news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=235018"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}